Remove autofs Package
Ensures the autofs automounter package is not installed, removing on-demand filesystem mounting unless it is explicitly required.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
With automounting enabled, anyone with physical access can attach a USB drive or disc and have its contents mounted automatically into the filesystem, even without permission to mount it themselves, a vector for malware delivery and data exfiltration. Removing autofs shrinks the attack surface on systems that do not need network or removable-media automounts (CIS 2.1.1).
What Pavois checks
Pavois asks dpkg (via the InSpec package resource) whether autofs is installed and expects it absent. Checking the effective package state is authoritative, it catches the automounter regardless of any leftover unit files or config.
describe package('autofs') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s autofs, expected package 'autofs' is not installed. Optionally confirm no automount service is active with systemctl is-active autofs (expected inactive/not found).
Inspect & investigate
dpkg -l autofsconfirms removal.- Mount/unmount activity (and any residual automount events) appears in
journalctl -u autofswhile installed, and current mounts are visible withfindmnt.
Remediation
Pavois's harden plan removes the autofs package (package resource, remove action) with pavois harden apply, which also stops and disables the automounter.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | autofs |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing autofs breaks any workflow that relies on on-demand mounts, commonly NFS home directories, automounted network shares, or removable-media automounting in kiosk/lab setups. Before applying, confirm no /etc/auto.master maps are in use (findmnt for autofs mounts) and that users do not depend on automounted homes, or you risk inaccessible directories after removal.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.